Case study: Chernobyl.  Compiled from Chernobyl.co.uk and the World Nuclear Association websites.

As Reactor Four was to be shutdown for routine maintenance on the 25 April 1986 it was decided to take advantage of this to run a test. The test was to check whether, in the event of a shutdown, there was enough electrical power from the coasting turbines to operate the emergency equipment and core cooling pumps until the diesel power supply came online.  As part of the test, the emergency equipment (the emergency core cooling system) was turned off to prevent it from coming on automatically and interfering with the planned test.  As the reactor shutdown proceeded, the reactor operated at approximately half power when the electric load dispatcher refused to allow further shutdown in order to meet power demands, thus halting the planned test. Without this delay, the reactor test would have occurred during the day shift.  As it was, the test was rescheduled for the night shift.  At about 23:00hrs on 25th April the grid controller agreed to a further reduction in power and the test continued.

For the test the reactor was to be stabilized at 1,000MW prior to shutdown, however, due to an operational error the power fell to about 30MW.  Reports are unclear whether the operator activated the wrong control, or failed to order others to hold power at required level, or the regulating system for the reactor did not respond properly.  What became clear later was that the Chernobyl reactor design enters an unsafe state below 700 MW where it develops a “positive void coefficient”.  Reactors that have a positive void coefficient become unstable at low power levels and can experience rapid uncontrollable power increases.  (In effect, excess steam in the reactor cooling circuit results in increased power generation and increased power generation results in increased steam production, leading to instability.  Most reactors are designed to have a negative void coefficient.)   From the 30MW state, the operators tried to raise the power by removing manual control rods and at 01:00hr on 26 April the reactor stabilized at 200MW.  Reports suggest the operators stabilized the reactor with fewer than the minimum 26 manual control rods that safety procedures required.  Following this event, the operators proceeded to continue with their planned test.  It was 1:03 am.

The operators increased water flow to the core, in accordance with the test.  This reduced the water level in the steam separator below normal levels.  As a result, the operators disabled the automatic alarm and trip on the steam separator so that it wouldn’t interfere in the test.  To increase pressure and temperature in the steam separator, the operators removed more manual control rods from the reactor, bringing down the number of control rods to 8.  It was 1:22 am and indications to the operator suggested that the reactor was stable.  In reality though, the cooling water in the reactor was being converted to steam as the reactivity of reactor increased.

At 1:23am the operators began the planned test by cutting flow to the turbines and in effect letting the turbines spin or “coast”.  The test then required a 10 second removal of the automatic control rods from the reactor to compensate for the flow changes due to taking the turbines offline. This occurred at 1:23:10.  At 1:23:35 steam in the reactor began to increase uncontrollably. At 1:23:44, reactor power surged to 100 times the designed limit for the plant.  At 1:24am the reactor exploded.